psf-bind-check(8)
ISC BIND 9 GSS-TSIG memory corruption: read-only checker (v1)
CVE-2026-94300
If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation
Replaying a GSS-TSIG signed UDP message can corrupt memory in named, the BIND 9
name server. ISC says that, combined with crafted queries to a zone the attacker
controls, it can lead to remote code execution, and at minimum it can crash
named. Rated High, CVSS 8.1 (the attack is complex: the attacker must capture a
signed message and replay it while the key is still valid). ISC knows of no
active exploitation and lists NO WORKAROUND.
Affected: BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29,
9.21.0 through 9.21.26 (and matching -S1 Supported Preview builds)
Fixed: 9.20.30 and 9.21.27 (9.20.30-S1 for the Preview Edition)
Move to: 9.20. The 9.18 branch and everything older is end of life. Distributions that still
support 9.18 may backport the fix: the script looks for that.
The code is present in every build, but the vulnerable path needs GSS-TSIG,
which is used for secure dynamic updates against Kerberos or Active Directory.
One analysis says builds without GSS-TSIG configured do not reach it; ISC's
advisory text does not spell out which configuration is required,
so the script reports whether GSS-TSIG is configured as a hint, never as proof
of safety, and tells you to update either way.
The same BIND releases fix three other denial of service flaws, which only the
update fixes.
This script is read-only. It finds named binaries (PATH, usual locations and
running processes), reads the version from "named -v", reads named.conf and its
include files, and looks for GSS-TSIG settings. It never reloads named.
Usage:
./bind-check.sh [command] [PATH-TO-named ...]
check (default) Exit 0 = nothing exposed, 1 = an affected version is exposed
or its configuration could not be read.
version print the script version.
Environment: NAMED_CONF (space separated files) replaces configuration discovery.
Containers: with no argument the check also looks in running docker and podman containers
(SCAN_CONTAINERS=1, the default; 0 skips them). A read-only probe captures the daemon's version
output and its configuration (secrets are redacted inside the container before anything is
copied) into a private temporary directory, and this script then runs once per container, in
isolation, against that copy. Paths shown as .../docker_NAME/... are inside the container NAME.The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
